I maintain a set of charts that keep track of REST APIs which create and delete resources (documents). In this particular case, tracking the maximum number of "open" documents, where a PUT creates the resource, and DELETE removes the resource. The search i attempted was: uri_path=*docs* (method=PUT OR method=DELETE) | eval s=case(method=="PUT",1,method=="DELETE",-1) | transaction documentid maxspan=24h startswith="method==PUT" endswith="method=DELETE" connected=t unifyends=t keepevicted=true | streamstats sum(s) as c by clientid | eventstats max(c) as mcc by clientid | stats max(mcc) as MaxOpenDocs by clientid however, MaxOpenDocs is always 0 (which is clearly wrong). My initial thought was to use accum, but it lacks a by clause. Any recommendations? Clearly I am missing something. ... View more